SSO Safeguard 8

It is possible to configure BitLocker to use TPM only rather than TPM+PIN, but this obviously does require a TPM module. I'm guessing from you saying BitLocker password the PC does not have TPM?

Hi Matt,

You have to make the required changes in the following Group Policy, either in Active Directory or locally on computers:

1. Require additional authentication at startup

2. Allow BitLocker without a compatible TPM

Please go to these Group Policy objects and you can enable or disable the settings according to your requirement. Let me know if this helps resolve your issue.

Sorry for the late response. I will give this a try in Group Policy. Also I am having an issue when installing Safeguard clients using a default policy, some machines are grabbing the correct policy and others are not. All computers are in the same OU in AD and I have the Management Console to sync. Any ideas?

Hi Matt,

Please help me the following questions:

1. What is the Operating System on the machines?

2. Do you see all the machines report to the Management Console?

1. Windows 10 Pro 64bit

2. I now see the machines responding to the Management Console. What I did was made changes to the policy and re-create a new Machine Client install. Once I installed the updated .msi All PC's were communicating and receiving the correct policy. 

Will I have to re-create a new manged client .msi everytime I make changes to the polices?

No you don't need to, I push out policy changes frequently and if the client is effectively communicating with the server it will receive and action the changes. I would suspect the previous managed MSI wasn't configured properly.

Hi Matt,

As Michael said, you don't have to create a new client install package every time you make changes to the policy. Now that the clients are communicating with the Management console, the policies will be updated during the next sync after the policy change.